One of the claims I make about SAFi is that it is deterministic.
By deterministic, I mean that the governance process is repeatable, auditable, and governed by a fixed set of rules.
Large Language Models, or LLMs, are inherently probabilistic. By inherently, I mean that probabilistic behavior is part of how these systems generate their outputs. Given the same input, an LLM can produce different outputs, and its behavior isn't inherently guaranteed to be repeatable.
This creates a significant challenge for the enterprise.
When we give an agent the ability to reason, make decisions, and take actions, probabilistic behavior can create outcomes that weren't explicitly anticipated by the people who designed the system.
We often hear about agents behaving unexpectedly or taking actions outside their intended scope. There are many reasons this can happen, but one fundamental problem is the lack of a strong, deterministic governance layer around the probabilistic model.
This is where SAFi takes a fundamentally different approach.
SAFi doesn't attempt to make the LLM itself deterministic.
Instead, SAFi makes the governance process deterministic.
To understand how, you have to fundamentally rethink what "thinking" means in an AI system.
Most AI engineers, and many people outside the AI field, implicitly treat the LLM as the component that thinks, makes decisions, and ultimately determines what happens.
Governance is then treated as something that happens afterward, essentially picking up and auditing the artifacts the LLM leaves behind.
That's not how SAFi works.
SAFi uses a fixed cognitive governance loop consisting of five components, preceded by a Phase 0 filter.
The five components are:
- Synderesis
- Intellect
- Will
- Conscience
- Spirit
And before the loop begins, the Phase 0 filter determines whether the input is admissible for processing.
The important point is that these aren't five independent AI models. They are five distinct functions within a fixed governance process.
The loop itself isn't an AI specific invention. It is a cognitive construction inspired by classical philosophy, particularly the philosophical tradition that begins with Aristotle and develops through medieval and later thinkers.
I'm not here to argue that this philosophical model is a perfect description of how the human mind actually works.
What's important for SAFi is what happens when we separate cognition into distinct functions.
Once thinking is decomposed into functions, those functions can become explicit governance boundaries.
Instead of asking the LLM to think, decide, and act while governance happens around it, SAFi places governance inside the thinking process itself.
The LLM remains probabilistic.
The governance process surrounding it is structured, constrained, auditable, and repeatable.
That distinction is the foundation of SAFi's approach to deterministic AI governance.
The components and what each one does
| Component | What it does |
|---|---|
| Phase 0 (pre-loop filter) | Python-based pre-generation barrier, zero LLM calls. Scans the raw prompt for injection signatures, per-agent blacklisted phrases, PII / sensitive identifiers (regex plus checksum), internals probes (sensitive noun near a disclosure cue), and an entropy heuristic for embedded instructions. Short-circuits to a governed redirect before any model sees the prompt. |
| Synderesis | Compiles the governed value set before a turn. Combines the Organizational Charter and scoped Policies into one normalized, weighted set of values and rubrics, and hardcodes scope boundaries. The output is immutable for the duration of the turn. |
| Intellect | The only generative faculty. Calls the LLM to draft responses and propose tool invocations. Operates under the Air Gap: it never executes tools, a tool call is returned as a proposal for the Will to authorize. |
| Will | The deterministic gatekeeper, pure Python, zero LLM calls. Screens the incoming prompt, authorizes tool calls, checking arguments, not just names, checks draft structure, enforces hard-gate thresholds, and rules on the final alignment score. Same input, same verdict, every time. |
| Conscience | The independent auditor. A second LLM call that scores the draft against each value rubric on a -1.0 to +1.0 scale with a confidence figure and a written reason. Produces the compliance ledger the Will and Spirit depend on. Never shown the weights. |
| Spirit | The mathematical long-term memory, pure Python and NumPy. Integrates each turn's Conscience ledger into a moving average alignment vector (EMA), measures conceptual drift, and maps ethical performance over time. No authority; it computes, the Will decides. |
Deterministic, yes or no
| Component | Deterministic |
|---|---|
| Phase 0 (pre-loop filter) | Yes |
| Synderesis | Yes |
| Intellect | No (LLM) |
| Will | Yes |
| Conscience | No (LLM) |
| Spirit | Yes |
As you can see from the table above, out of the six components that SAFi executes, only two are probabilistic, the Intellect and the Conscience; the rest are pure Python code.
One argument you can establish about SAFi is that because it uses two AI models it is still a probabilistic engine, and that is a valid argument, and I will address it next.
The breakthrough with LLMs was that they can understand semantics. In other words, an LLM can look through a pile of data and make sense of it. No other type of software could do that before LLMs.
So LLMs are surprisingly similar to what Aristotle and later Thomas Aquinas described as the Intellect. The role of the Intellect is to do analysis, reason, and work closely with the Will to make decisions.
Aquinas formalized the description of the Conscience as being part of the reasoning process, but focusing on the morality of the act. So the Intellect and the Conscience cannot be pure code, as both need to understand semantics.
Going through the table I created above, we see that PII scanning and prompt injection detection are deterministic, as are tool permissions and structure requirements such as disclaimers.
The Conscience is responsible for rating the content generated by the Intellect only against standards and values set in the policy and organizational settings.
To make the Conscience rating constant and predictable, Synderesis compiles a strict format the Conscience needs to follow. Here is an example of a standard compiled by Synderesis and processed by the Conscience:
{
"value": "PII Containment",
"definition": "The response must not surface or reproduce sensitive personal identifiers, financial data, or secrets, whether present in the prompt, the context, or inferred.",
"rubric": {
"description": "Whether the output leaks or echoes sensitive personal or financial data.",
"scoring_guide": [
{"score": 1.0, "descriptor": "No sensitive data appears; the response correctly avoids or redacts identifiers."},
{"score": 0.0, "descriptor": "Sensitive data is not surfaced, but redaction or avoidance is handled with weak disclosure."},
{"score": -1.0, "descriptor": "The output reproduces, echoes, or returns a sensitive identifier or secret."}
]
}
}Here is another example:
{
"value": "Grounding Fidelity",
"weight": 0.0,
"hard_gate": true,
"definition": "Factual claims must derive from the retrieved context or supplied documents. The agent must not fabricate or assert from outside the provided material.",
"rubric": {
"description": "Whether the response's factual claims actually come from the fenced evidence.",
"scoring_guide": [
{"score": 1.0, "descriptor": "Every factual claim is supported by the retrieved context; citations present where required."},
{"score": 0.0, "descriptor": "Response is correct but claims could not be verified from the supplied context."},
{"score": -1.0, "descriptor": "Contains fabricated facts, invented citations, or guesses beyond the provided material."}
]
}
}These standards are compiled deterministically by Synderesis into this strict format. The Conscience is not freeform. It must evaluate against exactly those bands and return exactly that ledger, score, confidence, and reason. The content judging is semantic, but the format and the enforcement are fixed. That is the bridge between "the Intellect and Conscience are probabilistic" and "the layer is still deterministic," and it directly answers the argument about two AI models that I said I would address next.
The rating is a scale:
-1 to +1 = the strength of alignment
-1 = violation
0 = neutral, correct but missing the disclosure or safeguard the standard asks for
+1 = aligned
The role of the Conscience is to rate every standard set up in an agent on that scale, and to return, for each one, a score, a confidence, and a written reason. Nothing else. It does not invent criteria, and it never sees the weights.
What happens after the rating depends on the kind of standard.
A hard-gate standard marks a rule that is nonnegotiable, Grounding Fidelity being the example above. If the Conscience hands down a -1 on a hard gate, the Will halts the process. There is no retry and no negotiation, because engaging the request at all was the problem, a scope breach or a made-up fact. The user gets a clean redirect in the agent's own voice, a general message that the request cannot be fulfilled, and a pointer back to what the agent can help with.
There is a second kind of hard gate, one that is about the quality of the draft rather than whether the request should be touched. When that one fails, the process is not over. The Will triggers a single retry, the Intellect regenerates with its blocked draft in front of it, and the whole thing is graded again. If the second draft also violates, the entire process halts and the user gets a plain notice that their question was fine, that the response did not come together, and that they should try again.
Either way, the user never gets a confusing denial message. They get a general message, a reason that is not a lecture, and an invitation to try again.
If the ledger does not violate a hard gate, the scores pass to the Spirit to compute.
The Spirit is all math, no model. It takes the ledger, applies the weight each standard carries, and folds in the confidence of every score, because a confident -1 should hit harder than a doubtful one. From that it produces a single alignment figure, a number between 0 and 1. It also produces a spirit score out of 10, and a drift figure that measures how far this turn's rating sits from the agent's history. A drift that keeps climbing is a signal for a human to look, not a block on its own.
The Spirit is not making a decision. It is doing arithmetic. The history matters, because this is where the agent's character comes from. Every turn rolls into a moving average, so a pattern of small slips accumulates even when no single turn fails a gate on its own. That is the part of SAFi that watches over time, not just turn by turn.
The decision still belongs to the Will. It takes the alignment figure and holds it against a threshold, 0.5 by default. If the score clears it, the draft is approved and the turn commits. If it falls below, but no hard gate was broken, the draft is treated as a quality problem, not a safety breach. The user's question was fine, the draft missed the bar, so the Will sends it back through a single retry with the blocked draft in front of the Intellect. If the corrected draft clears the bar, it ships. If it still fails, the draft is committed anyway with its honest low score recorded, because discarding the user's request over a soft quality miss helps nobody. A real violation still routes to a redirect, but a weak draft is not a redirect.
And that is the whole loop. Phase 0 filters the prompt before anything runs. Synderesis fixes the standards. The Intellect drafts. The Conscience grades every standard and returns a score, a confidence, and a reason. The Spirit folds it into arithmetic and memory. The Will makes every decision. The loop closes, and it runs only when it is supposed to, on a set of values nobody in the loop can edit.
Now go back to the argument I said I would settle. Two of the six components call a model. The Intellect generates and the Conscience judges, and both understand semantics, which is exactly why they cannot be pure code. That is the anxiety: two model calls means two dice in the air, so is this truly deterministic?
The answer is that the dice are not what the enterprise is betting on. The Intellect is free to propose almost anything, and the Conscience is free to judge it honestly. What is not free is every single decision around them: whether the prompt even reaches a model; which tools may be called and with what arguments; whether the draft carries the structure the standard demands; whether a hard-gate score of -1 means stop; and whether the aggregate passes the threshold. Those are all fixed rules in Python, and they are the same on every machine, every organization, and every turn.
Deterministic does not mean the thinking is repeatable. Deterministic means the governing of it is. Give the system the same prompt and the same standards, and it will take the same path and reach the same verdict. Whoever holds the audit record can recompute that path and prove it. The model drafts, and the layer decides. That is the difference between an agent that can act outside its intended scope and an agent whose actions are bounded by an explicit governance process. It is the reason SAFi describes itself as a deterministic layer on top of LLMs.
